diff --git a/crates/integration-tests/tests/common/runtime.rs b/crates/integration-tests/tests/common/runtime.rs
index 4a1cdcec..22bfaf42 100644
--- a/crates/integration-tests/tests/common/runtime.rs
+++ b/crates/integration-tests/tests/common/runtime.rs
@@ -52,7 +52,6 @@ pub enum TestError {
     #[display("Expected HTTP status {expected}, got {actual}")]
     UnexpectedStatusCode { expected: u16, actual: u16 },
 
-
     #[display("JSON field assertion failed: {field}")]
     JsonFieldMismatch { field: String },
 
diff --git a/crates/js/lib/src/integrations/prebid/_user_ids.generated.ts b/crates/js/lib/src/integrations/prebid/_user_ids.generated.ts
new file mode 100644
index 00000000..9eb586dd
--- /dev/null
+++ b/crates/js/lib/src/integrations/prebid/_user_ids.generated.ts
@@ -0,0 +1,22 @@
+// Auto-generated by build-all.mjs — manual edits will be overwritten at build time.
+//
+// Controls which Prebid.js User ID submodules are included in the bundle.
+// Set the TSJS_PREBID_USER_IDS environment variable to a comma-separated
+// list of submodule filenames without the `.js` extension
+// (e.g. "sharedIdSystem,id5IdSystem,criteoIdSystem") before building.
+// The userId.js core module is always included via a static import in
+// index.ts and is not configurable here.
+
+import 'prebid.js/modules/sharedIdSystem.js';
+import 'prebid.js/modules/criteoIdSystem.js';
+import 'prebid.js/modules/33acrossIdSystem.js';
+import 'prebid.js/modules/pubProvidedIdSystem.js';
+import 'prebid.js/modules/quantcastIdSystem.js';
+import 'prebid.js/modules/id5IdSystem.js';
+import 'prebid.js/modules/identityLinkIdSystem.js';
+import 'prebid.js/modules/uid2IdSystem.js';
+import 'prebid.js/modules/euidIdSystem.js';
+import 'prebid.js/modules/intentIqIdSystem.js';
+import 'prebid.js/modules/lotamePanoramaIdSystem.js';
+import 'prebid.js/modules/connectIdSystem.js';
+import 'prebid.js/modules/merkleIdSystem.js';
diff --git a/crates/js/lib/src/integrations/prebid/index.ts b/crates/js/lib/src/integrations/prebid/index.ts
index 5b7cad6d..41500c50 100644
--- a/crates/js/lib/src/integrations/prebid/index.ts
+++ b/crates/js/lib/src/integrations/prebid/index.ts
@@ -466,7 +466,8 @@ function syncPrebidEidsCookie(): void {
       return; // Single EID too large — skip.
     }
 
-    document.cookie = `${EID_COOKIE_NAME}=${encoded}; Path=/; Secure; SameSite=Lax; Max-Age=${EID_COOKIE_MAX_AGE}`;
+    document.cookie =
+      `${EID_COOKIE_NAME}=${encoded}; Path=/; Secure; SameSite=Lax; Max-Age=${EID_COOKIE_MAX_AGE}`;
 
     log.debug(`[tsjs-prebid] synced ${payload.length} EIDs to cookie`);
   } catch (err) {
diff --git a/crates/js/lib/src/integrations/sourcepoint/index.ts b/crates/js/lib/src/integrations/sourcepoint/index.ts
new file mode 100644
index 00000000..1e3d7cea
--- /dev/null
+++ b/crates/js/lib/src/integrations/sourcepoint/index.ts
@@ -0,0 +1,95 @@
+import { log } from '../../core/log';
+
+const SP_CONSENT_PREFIX = '_sp_user_consent_';
+const GPP_COOKIE_NAME = '__gpp';
+const GPP_SID_COOKIE_NAME = '__gpp_sid';
+
+interface SourcepointGppData {
+  gppString: string;
+  applicableSections: number[];
+}
+
+interface SourcepointConsentPayload {
+  gppData?: SourcepointGppData;
+}
+
+function findSourcepointConsent(): SourcepointConsentPayload | null {
+  // Sourcepoint stores one consent payload per property under `_sp_user_consent_*`.
+  // We intentionally take the first valid match and mirror that origin-scoped payload.
+  for (let i = 0; i < localStorage.length; i++) {
+    const key = localStorage.key(i);
+    if (!key?.startsWith(SP_CONSENT_PREFIX)) continue;
+
+    const raw = localStorage.getItem(key);
+    if (!raw) continue;
+
+    try {
+      const payload = JSON.parse(raw) as SourcepointConsentPayload;
+      if (payload.gppData?.gppString) {
+        return payload;
+      }
+    } catch {
+      log.debug('sourcepoint: failed to parse localStorage value', { key });
+    }
+  }
+  return null;
+}
+
+function writeCookie(name: string, value: string): void {
+  document.cookie = `${name}=${value}; path=/; Secure; SameSite=Lax`;
+}
+
+function clearCookie(name: string): void {
+  // Trusted Server is the only intended writer for these mirrored cookies, so
+  // clearing the origin-scoped cookie is sufficient for this integration.
+  document.cookie = `${name}=; path=/; Secure; SameSite=Lax; Max-Age=0`;
+}
+
+/**
+ * Reads Sourcepoint consent from localStorage and mirrors it into
+ * `__gpp` and `__gpp_sid` cookies for Trusted Server to read.
+ *
+ * Returns `true` if cookies were written, `false` otherwise.
+ */
+export function mirrorSourcepointConsent(): boolean {
+  if (typeof localStorage === 'undefined' || typeof document === 'undefined') {
+    return false;
+  }
+
+  const payload = findSourcepointConsent();
+  if (!payload?.gppData) {
+    clearCookie(GPP_COOKIE_NAME);
+    clearCookie(GPP_SID_COOKIE_NAME);
+    log.debug('sourcepoint: no GPP data found in localStorage');
+    return false;
+  }
+
+  const { gppString, applicableSections } = payload.gppData;
+  if (!gppString) {
+    clearCookie(GPP_COOKIE_NAME);
+    clearCookie(GPP_SID_COOKIE_NAME);
+    log.debug('sourcepoint: gppString is empty');
+    return false;
+  }
+
+  writeCookie(GPP_COOKIE_NAME, gppString);
+
+  if (Array.isArray(applicableSections) && applicableSections.length > 0) {
+    writeCookie(GPP_SID_COOKIE_NAME, applicableSections.join(','));
+  } else {
+    clearCookie(GPP_SID_COOKIE_NAME);
+  }
+
+  log.info('sourcepoint: mirrored GPP consent to cookies', {
+    gppLength: gppString.length,
+    sections: applicableSections,
+  });
+
+  return true;
+}
+
+if (typeof window !== 'undefined') {
+  mirrorSourcepointConsent();
+}
+
+export default mirrorSourcepointConsent;
diff --git a/crates/js/lib/test/integrations/prebid/index.test.ts b/crates/js/lib/test/integrations/prebid/index.test.ts
index 5855ebfa..56d5c772 100644
--- a/crates/js/lib/test/integrations/prebid/index.test.ts
+++ b/crates/js/lib/test/integrations/prebid/index.test.ts
@@ -6,9 +6,9 @@ const {
   mockProcessQueue,
   mockRequestBids,
   mockRegisterBidAdapter,
+  mockGetUserIdsAsEids,
   mockPbjs,
   mockGetBidAdapter,
-  mockGetUserIdsAsEids,
   mockAdapterManager,
 } = vi.hoisted(() => {
   const mockSetConfig = vi.fn();
@@ -16,7 +16,9 @@ const {
   const mockRequestBids = vi.fn();
   const mockRegisterBidAdapter = vi.fn();
   const mockGetBidAdapter = vi.fn();
-  const mockGetUserIdsAsEids = vi.fn();
+  const mockGetUserIdsAsEids = vi.fn(
+    () => [] as Array<{ source: string; uids?: Array<{ id: string; atype?: number }> }>
+  );
   const mockPbjs = {
     setConfig: mockSetConfig,
     processQueue: mockProcessQueue,
@@ -33,9 +35,9 @@ const {
     mockProcessQueue,
     mockRequestBids,
     mockRegisterBidAdapter,
+    mockGetUserIdsAsEids,
     mockPbjs,
     mockGetBidAdapter,
-    mockGetUserIdsAsEids,
     mockAdapterManager,
   };
 });
diff --git a/crates/js/lib/test/integrations/sourcepoint/index.test.ts b/crates/js/lib/test/integrations/sourcepoint/index.test.ts
new file mode 100644
index 00000000..f276f241
--- /dev/null
+++ b/crates/js/lib/test/integrations/sourcepoint/index.test.ts
@@ -0,0 +1,151 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { mirrorSourcepointConsent } from '../../../src/integrations/sourcepoint';
+
+describe('integrations/sourcepoint', () => {
+  function clearAllCookies(): void {
+    document.cookie.split(';').forEach((c) => {
+      const name = c.split('=')[0].trim();
+      if (name) document.cookie = `${name}=; path=/; Max-Age=0`;
+    });
+  }
+
+  function getCookie(name: string): string | undefined {
+    const match = document.cookie.split('; ').find((c) => c.startsWith(`${name}=`));
+    return match ? match.split('=').slice(1).join('=') : undefined;
+  }
+
+  beforeEach(() => {
+    // Clear cookies and localStorage before each test.
+    clearAllCookies();
+    localStorage.clear();
+  });
+
+  afterEach(() => {
+    clearAllCookies();
+    localStorage.clear();
+  });
+
+  it('mirrors __gpp and __gpp_sid from _sp_user_consent_* localStorage as session cookies', () => {
+    const payload = {
+      gppData: {
+        gppString: 'DBABLA~BVQqAAAAAgA.QA',
+        applicableSections: [7],
+      },
+    };
+    localStorage.setItem('_sp_user_consent_36026', JSON.stringify(payload));
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(true);
+    expect(document.cookie).toContain('__gpp=DBABLA~BVQqAAAAAgA.QA');
+    expect(document.cookie).toContain('__gpp_sid=7');
+  });
+
+  it('handles multiple applicable sections', () => {
+    const payload = {
+      gppData: {
+        gppString: 'DBABLA~BVQqAAAAAgA.QA',
+        applicableSections: [7, 8],
+      },
+    };
+    localStorage.setItem('_sp_user_consent_99999', JSON.stringify(payload));
+
+    mirrorSourcepointConsent();
+
+    expect(document.cookie).toContain('__gpp_sid=7,8');
+  });
+
+  it('returns false when no _sp_user_consent_* key exists', () => {
+    localStorage.setItem('unrelated_key', 'value');
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(false);
+    expect(document.cookie).not.toContain('__gpp=');
+    expect(document.cookie).not.toContain('__gpp_sid=');
+  });
+
+  it('clears stale mirrored cookies when no valid Sourcepoint payload exists', () => {
+    document.cookie = '__gpp=stale-gpp; path=/';
+    document.cookie = '__gpp_sid=7,8; path=/';
+    localStorage.setItem('unrelated_key', 'value');
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(false);
+    expect(getCookie('__gpp')).toBeUndefined();
+    expect(getCookie('__gpp_sid')).toBeUndefined();
+  });
+
+  it('returns false for malformed JSON in localStorage', () => {
+    localStorage.setItem('_sp_user_consent_12345', 'not-json!!!');
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(false);
+    expect(document.cookie).not.toContain('__gpp=');
+  });
+
+  it('skips malformed entries when a later Sourcepoint key is valid', () => {
+    localStorage.setItem('_sp_user_consent_12345', 'not-json!!!');
+    localStorage.setItem(
+      '_sp_user_consent_67890',
+      JSON.stringify({
+        gppData: {
+          gppString: 'DBABLA~BVQqAAAAAgA.QA',
+          applicableSections: [7],
+        },
+      })
+    );
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(true);
+    expect(getCookie('__gpp')).toBe('DBABLA~BVQqAAAAAgA.QA');
+    expect(getCookie('__gpp_sid')).toBe('7');
+  });
+
+  it('returns false when gppData is missing from payload', () => {
+    localStorage.setItem('_sp_user_consent_12345', JSON.stringify({ otherField: true }));
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(false);
+    expect(document.cookie).not.toContain('__gpp=');
+  });
+
+  it('returns false when gppString is empty', () => {
+    const payload = {
+      gppData: {
+        gppString: '',
+        applicableSections: [7],
+      },
+    };
+    localStorage.setItem('_sp_user_consent_12345', JSON.stringify(payload));
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(false);
+    expect(document.cookie).not.toContain('__gpp=');
+  });
+
+  it('clears stale __gpp_sid when the payload has no applicable sections', () => {
+    document.cookie = '__gpp_sid=7,8; path=/';
+    localStorage.setItem(
+      '_sp_user_consent_12345',
+      JSON.stringify({
+        gppData: {
+          gppString: 'DBABLA~BVQqAAAAAgA.QA',
+          applicableSections: [],
+        },
+      })
+    );
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(true);
+    expect(getCookie('__gpp')).toBe('DBABLA~BVQqAAAAAgA.QA');
+    expect(getCookie('__gpp_sid')).toBeUndefined();
+  });
+});
diff --git a/crates/trusted-server-core/src/consent/gpp.rs b/crates/trusted-server-core/src/consent/gpp.rs
index 9d0e5c81..bd8c12f2 100644
--- a/crates/trusted-server-core/src/consent/gpp.rs
+++ b/crates/trusted-server-core/src/consent/gpp.rs
@@ -72,10 +72,13 @@ pub fn decode_gpp_string(gpp_string: &str) -> Result<GppConsent, Report<ConsentD
     let eu_tcf = decode_tcf_from_gpp(&parsed);
 
     // The GPP header version is always 1 for current spec.
+    let us_sale_opt_out = decode_us_sale_opt_out(&parsed);
+
     Ok(GppConsent {
         version: 1,
         section_ids,
         eu_tcf,
+        us_sale_opt_out,
     })
 }
 
@@ -100,6 +103,84 @@ fn decode_tcf_from_gpp(parsed: &iab_gpp::v1::GPPString) -> Option<TcfConsent> {
     }
 }
 
+/// GPP section IDs that represent US state/national privacy sections.
+///
+/// Range 7–23 per the GPP v1 specification:
+/// 7=UsNat, 8=UsCa, 9=UsVa, 10=UsCo, 11=UsUt, 12=UsCt, 13=UsFl,
+/// 14=UsMt, 15=UsOr, 16=UsTx, 17=UsDe, 18=UsIa, 19=UsNe, 20=UsNh,
+/// 21=UsNj, 22=UsTn, 23=UsMn.
+const US_SECTION_ID_RANGE: std::ops::RangeInclusive<u16> = 7..=23;
+
+/// Extracts the `sale_opt_out` signal across all US sections in a parsed GPP
+/// string.
+///
+/// Iterates through section IDs looking for any in the US range (7–23),
+/// decodes each US section, and aggregates the result conservatively:
+///
+/// - `Some(true)` if any decodable US section says the user opted out of sale
+/// - `Some(false)` if at least one decodable US section says they did not opt
+///   out and none say they opted out
+/// - `None` if no US section is present or no decodable US section yields a
+///   usable `sale_opt_out` signal
+fn decode_us_sale_opt_out(parsed: &iab_gpp::v1::GPPString) -> Option<bool> {
+    let mut saw_not_opted_out = false;
+
+    for us_section_id in parsed
+        .section_ids()
+        .filter(|id| US_SECTION_ID_RANGE.contains(&(**id as u16)))
+    {
+        match parsed.decode_section(*us_section_id) {
+            Ok(section) => match us_sale_opt_out_from_section(&section) {
+                Some(true) => return Some(true),
+                Some(false) => saw_not_opted_out = true,
+                None => {}
+            },
+            Err(e) => {
+                log::warn!("Failed to decode US GPP section {us_section_id}: {e}");
+            }
+        }
+    }
+
+    if saw_not_opted_out {
+        Some(false)
+    } else {
+        None
+    }
+}
+
+fn us_sale_opt_out_from_section(section: &iab_gpp::sections::Section) -> Option<bool> {
+    use iab_gpp::sections::us_common::OptOut;
+    use iab_gpp::sections::Section;
+
+    // Keep this match in sync with new US-state variants added by `iab_gpp`.
+    let sale_opt_out = match section {
+        Section::UsNat(s) => match &s.core {
+            iab_gpp::sections::usnat::Core::V1(c) => &c.sale_opt_out,
+            iab_gpp::sections::usnat::Core::V2(c) => &c.sale_opt_out,
+            _ => return None,
+        },
+        Section::UsCa(s) => &s.core.sale_opt_out,
+        Section::UsVa(s) => &s.core.sale_opt_out,
+        Section::UsCo(s) => &s.core.sale_opt_out,
+        Section::UsUt(s) => &s.core.sale_opt_out,
+        Section::UsCt(s) => &s.core.sale_opt_out,
+        Section::UsFl(s) => &s.core.sale_opt_out,
+        Section::UsMt(s) => &s.core.sale_opt_out,
+        Section::UsOr(s) => &s.core.sale_opt_out,
+        Section::UsTx(s) => &s.core.sale_opt_out,
+        Section::UsDe(s) => &s.core.sale_opt_out,
+        Section::UsIa(s) => &s.core.sale_opt_out,
+        Section::UsNe(s) => &s.core.sale_opt_out,
+        Section::UsNh(s) => &s.core.sale_opt_out,
+        Section::UsNj(s) => &s.core.sale_opt_out,
+        Section::UsTn(s) => &s.core.sale_opt_out,
+        Section::UsMn(s) => &s.core.sale_opt_out,
+        _ => return None,
+    };
+
+    Some(*sale_opt_out == OptOut::OptedOut)
+}
+
 /// Parses a `__gpp_sid` cookie value into a vector of section IDs.
 ///
 /// The cookie is a comma-separated list of integer section IDs, e.g. `"2,6"`.
@@ -239,4 +320,154 @@ mod tests {
             "all-invalid should be None"
         );
     }
+
+    #[test]
+    fn decodes_us_sale_opt_out_not_opted_out() {
+        let result = decode_gpp_string("DBABLA~BVQqAAAAAgA.QA");
+        match &result {
+            Ok(gpp) => {
+                assert_eq!(
+                    gpp.us_sale_opt_out,
+                    Some(false),
+                    "should extract sale_opt_out=false from UsNat section"
+                );
+            }
+            Err(e) => {
+                panic!("GPP decode failed: {e}");
+            }
+        }
+    }
+
+    fn encode_fibonacci_integer(mut value: u16) -> String {
+        let mut fibs = vec![1_u16];
+        let mut next = 2_u16;
+        while next <= value {
+            fibs.push(next);
+            next = if fibs.len() == 1 {
+                2
+            } else {
+                fibs[fibs.len() - 1] + fibs[fibs.len() - 2]
+            };
+        }
+
+        let mut bits = vec![false; fibs.len()];
+        for (idx, fib) in fibs.iter().enumerate().rev() {
+            if *fib <= value {
+                value -= *fib;
+                bits[idx] = true;
+            }
+        }
+        bits.push(true);
+
+        bits.into_iter()
+            .map(|bit| if bit { '1' } else { '0' })
+            .collect()
+    }
+
+    fn encode_header(section_ids: &[u16]) -> String {
+        const BASE64_URL: &[u8; 64] =
+            b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+
+        let mut bits = String::from("000011000001");
+        bits.push_str(&format!("{:012b}", section_ids.len()));
+
+        let mut previous = 0_u16;
+        for &section_id in section_ids {
+            bits.push('0');
+            bits.push_str(&encode_fibonacci_integer(section_id - previous));
+            previous = section_id;
+        }
+
+        while bits.len() % 6 != 0 {
+            bits.push('0');
+        }
+
+        bits.as_bytes()
+            .chunks(6)
+            .map(|chunk| {
+                let value = u8::from_str_radix(
+                    core::str::from_utf8(chunk).expect("should encode header bits as utf8"),
+                    2,
+                )
+                .expect("should parse 6-bit chunk");
+                char::from(BASE64_URL[value as usize])
+            })
+            .collect()
+    }
+
+    fn gpp_with_sections(sections: &[(u16, &str)]) -> String {
+        let ids = sections.iter().map(|(id, _)| *id).collect::<Vec<_>>();
+        let header = encode_header(&ids);
+        let section_payloads = sections.iter().map(|(_, raw)| *raw).collect::<Vec<_>>();
+        format!("{header}~{}", section_payloads.join("~"))
+    }
+
+    #[test]
+    fn no_us_section_returns_none() {
+        let result = decode_gpp_string(GPP_TCF_AND_USP).expect("should decode GPP");
+        assert_eq!(
+            result.us_sale_opt_out, None,
+            "should return None when no US section (7-23) is present"
+        );
+    }
+
+    #[test]
+    fn later_us_section_opt_out_overrides_earlier_non_opt_out() {
+        let gpp = gpp_with_sections(&[(7, "BVQqAAAAAgA.QA"), (9, "BVVVVVVVVWA.AA")]);
+
+        let result = decode_gpp_string(&gpp).expect("should decode multi-section US GPP");
+
+        assert_eq!(
+            result.us_sale_opt_out,
+            Some(true),
+            "should treat any later decodable opt-out as authoritative"
+        );
+    }
+
+    #[test]
+    fn multiple_us_sections_without_opt_out_return_false() {
+        let gpp = gpp_with_sections(&[(7, "BVQqAAAAAgA.QA"), (9, "BVgVVVVVVWA.AA")]);
+
+        let result = decode_gpp_string(&gpp).expect("should decode multi-section US GPP");
+
+        assert_eq!(
+            result.us_sale_opt_out,
+            Some(false),
+            "should return false when decodable US sections consistently do not opt out"
+        );
+    }
+
+    #[test]
+    fn valid_opt_out_wins_even_if_another_us_section_is_undecodable() {
+        let gpp = gpp_with_sections(&[(7, "BVQqAAAAAgA.QA"), (9, "not-a-valid-usva-section")]);
+
+        let result = decode_gpp_string(&gpp).expect("should decode GPP header with raw sections");
+
+        assert_eq!(
+            result.us_sale_opt_out,
+            Some(false),
+            "should keep a valid non-opt-out signal even when another US section fails to decode"
+        );
+
+        let gpp = gpp_with_sections(&[(7, "not-a-valid-usnat-section"), (9, "BVVVVVVVVWA.AA")]);
+        let result = decode_gpp_string(&gpp).expect("should decode GPP header with raw sections");
+
+        assert_eq!(
+            result.us_sale_opt_out,
+            Some(true),
+            "should let a valid opt-out win even when another US section fails to decode"
+        );
+    }
+
+    #[test]
+    fn only_undecodable_us_sections_return_none() {
+        let gpp = gpp_with_sections(&[(7, "not-a-valid-usnat-section"), (9, "also-invalid")]);
+
+        let result = decode_gpp_string(&gpp).expect("should decode GPP header with raw sections");
+
+        assert_eq!(
+            result.us_sale_opt_out, None,
+            "should return None when no decodable US section yields sale_opt_out"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/consent/mod.rs b/crates/trusted-server-core/src/consent/mod.rs
index aed71281..7f77deb3 100644
--- a/crates/trusted-server-core/src/consent/mod.rs
+++ b/crates/trusted-server-core/src/consent/mod.rs
@@ -507,6 +507,12 @@ pub fn allows_ec_creation(ctx: &ConsentContext) -> bool {
             if let Some(tcf) = effective_tcf(ctx) {
                 return tcf.has_storage_consent();
             }
+            // Check GPP US section for sale opt-out.
+            if let Some(gpp) = &ctx.gpp {
+                if let Some(opted_out) = gpp.us_sale_opt_out {
+                    return !opted_out;
+                }
+            }
             // Check US Privacy string for explicit opt-out.
             if let Some(usp) = &ctx.us_privacy {
                 return usp.opt_out_sale != PrivacyFlag::Yes;
@@ -721,6 +727,7 @@ mod tests {
                 version: 1,
                 section_ids: vec![2],
                 eu_tcf: Some(make_tcf(gpp_last_updated_ds, gpp_allows_eids)),
+                us_sale_opt_out: None,
             }),
             ..ConsentContext::default()
         }
@@ -884,6 +891,7 @@ mod tests {
                 version: 1,
                 section_ids: vec![2],
                 eu_tcf: Some(make_tcf(0, true)),
+                us_sale_opt_out: None,
             }),
             ..ConsentContext::default()
         };
@@ -966,6 +974,7 @@ mod tests {
                 version: 1,
                 section_ids: vec![2],
                 eu_tcf: Some(make_tcf_with_storage(true)),
+                us_sale_opt_out: None,
             }),
             gdpr_applies: true,
             ..ConsentContext::default()
@@ -1159,4 +1168,126 @@ mod tests {
             "TCF consent should take priority over US Privacy opt-out when both present"
         );
     }
+
+    #[test]
+    fn ec_allowed_us_state_gpp_no_sale_opt_out() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("TN".to_owned()),
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![7],
+                eu_tcf: None,
+                us_sale_opt_out: Some(false),
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            allows_ec_creation(&ctx),
+            "US state + GPP US sale_opt_out=false should allow EC"
+        );
+    }
+
+    #[test]
+    fn ec_blocked_us_state_gpp_sale_opted_out() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("TN".to_owned()),
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![7],
+                eu_tcf: None,
+                us_sale_opt_out: Some(true),
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            !allows_ec_creation(&ctx),
+            "US state + GPP US sale_opt_out=true should block EC"
+        );
+    }
+
+    #[test]
+    fn ec_blocked_us_state_gpc_overrides_gpp_us() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("TN".to_owned()),
+            gpc: true,
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![7],
+                eu_tcf: None,
+                us_sale_opt_out: Some(false),
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            !allows_ec_creation(&ctx),
+            "GPC should block EC even when GPP US says no opt-out"
+        );
+    }
+
+    #[test]
+    fn ec_us_state_tcf_takes_priority_over_gpp_us() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("TN".to_owned()),
+            tcf: Some(make_tcf_with_storage(true)),
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![7],
+                eu_tcf: None,
+                us_sale_opt_out: Some(true),
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            allows_ec_creation(&ctx),
+            "TCF consent should take priority over GPP US opt-out"
+        );
+    }
+
+    #[test]
+    fn ec_us_state_gpp_us_takes_priority_over_us_privacy() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("TN".to_owned()),
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![7],
+                eu_tcf: None,
+                us_sale_opt_out: Some(false),
+            }),
+            us_privacy: Some(UsPrivacy {
+                version: 1,
+                notice_given: PrivacyFlag::Yes,
+                opt_out_sale: PrivacyFlag::Yes,
+                lspa_covered: PrivacyFlag::NotApplicable,
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            allows_ec_creation(&ctx),
+            "GPP US should take priority over us_privacy opt-out"
+        );
+    }
+
+    #[test]
+    fn ec_us_state_gpp_no_us_section_falls_through_to_us_privacy() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("CA".to_owned()),
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![2],
+                eu_tcf: None,
+                us_sale_opt_out: None,
+            }),
+            us_privacy: Some(UsPrivacy {
+                version: 1,
+                notice_given: PrivacyFlag::Yes,
+                opt_out_sale: PrivacyFlag::No,
+                lspa_covered: PrivacyFlag::NotApplicable,
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            allows_ec_creation(&ctx),
+            "GPP without US section should fall through to us_privacy"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/consent/types.rs b/crates/trusted-server-core/src/consent/types.rs
index a68eda9a..44f1a3df 100644
--- a/crates/trusted-server-core/src/consent/types.rs
+++ b/crates/trusted-server-core/src/consent/types.rs
@@ -302,6 +302,13 @@ pub struct GppConsent {
     pub section_ids: Vec<u16>,
     /// Decoded EU TCF v2.2 section (if present in GPP, section ID 2).
     pub eu_tcf: Option<TcfConsent>,
+    /// Whether the user opted out of sale of personal information via a US GPP
+    /// section (IDs 7–23).
+    ///
+    /// - `Some(true)` — a US section is present and `sale_opt_out == OptedOut`
+    /// - `Some(false)` — a US section is present and user did not opt out
+    /// - `None` — no US section exists in the GPP string
+    pub us_sale_opt_out: Option<bool>,
 }
 
 // ---------------------------------------------------------------------------
diff --git a/crates/trusted-server-core/src/integrations/registry.rs b/crates/trusted-server-core/src/integrations/registry.rs
index f5a17a5f..f145d35c 100644
--- a/crates/trusted-server-core/src/integrations/registry.rs
+++ b/crates/trusted-server-core/src/integrations/registry.rs
@@ -782,14 +782,14 @@ impl IntegrationRegistry {
 
     /// Return JS module IDs that should be included in the tsjs bundle.
     ///
-    /// Always includes "creative" (JS-only, no Rust-side registration).
+    /// Always includes JS-only modules with no Rust-side registration.
     /// Excludes integrations that have no JS module (e.g., "nextjs").
     #[must_use]
     pub fn js_module_ids(&self) -> Vec<&'static str> {
         // Rust-only integrations with no corresponding JS module
         const JS_EXCLUDED: &[&str] = &["nextjs", "aps", "adserver_mock"];
         // JS-only modules always included (no Rust-side registration)
-        const JS_ALWAYS: &[&str] = &["creative"];
+        const JS_ALWAYS: &[&str] = &["creative", "sourcepoint"];
 
         let mut ids: Vec<&'static str> = JS_ALWAYS.to_vec();
 
@@ -1367,7 +1367,7 @@ mod tests {
     }
 
     #[test]
-    fn js_module_ids_immediate_excludes_prebid() {
+    fn js_module_ids_immediate_excludes_prebid_and_includes_js_only_modules() {
         let settings = crate::test_support::tests::create_test_settings();
         let mut settings_with_prebid = settings;
         settings_with_prebid
@@ -1395,6 +1395,14 @@ mod tests {
             all.contains(&"prebid"),
             "should include prebid in full list"
         );
+        assert!(
+            immediate.contains(&"creative"),
+            "should include creative in immediate IDs"
+        );
+        assert!(
+            immediate.contains(&"sourcepoint"),
+            "should include sourcepoint in immediate IDs"
+        );
         assert!(
             !immediate.contains(&"prebid"),
             "should not include prebid in immediate IDs"
diff --git a/crates/trusted-server-core/src/platform/test_support.rs b/crates/trusted-server-core/src/platform/test_support.rs
index 42e3539e..1c167b99 100644
--- a/crates/trusted-server-core/src/platform/test_support.rs
+++ b/crates/trusted-server-core/src/platform/test_support.rs
@@ -142,8 +142,6 @@ pub(crate) struct StubHttpClient {
     calls: Mutex<Vec<String>>,
     // (status_code, body_bytes) — kept Send by avoiding Body::Stream
     responses: Mutex<VecDeque<(u16, Vec<u8>)>>,
-    // Headers captured per send call, stored as (name, value) string pairs.
-    request_headers: Mutex<Vec<Vec<(String, String)>>>,
 }
 
 impl StubHttpClient {
@@ -151,7 +149,6 @@ impl StubHttpClient {
         Self {
             calls: Mutex::new(Vec::new()),
             responses: Mutex::new(VecDeque::new()),
-            request_headers: Mutex::new(Vec::new()),
         }
     }
 
@@ -181,22 +178,6 @@ impl PlatformHttpClient for StubHttpClient {
             .expect("should lock calls")
             .push(request.backend_name.clone());
 
-        let headers: Vec<(String, String)> = request
-            .request
-            .headers()
-            .iter()
-            .filter_map(|(name, value)| {
-                value
-                    .to_str()
-                    .ok()
-                    .map(|v| (name.as_str().to_string(), v.to_string()))
-            })
-            .collect();
-        self.request_headers
-            .lock()
-            .expect("should lock request_headers")
-            .push(headers);
-
         let (status, body_bytes) = self
             .responses
             .lock()
diff --git a/docs/guide/integrations/prebid.md b/docs/guide/integrations/prebid.md
index f7b7a910..2be659fd 100644
--- a/docs/guide/integrations/prebid.md
+++ b/docs/guide/integrations/prebid.md
@@ -223,6 +223,43 @@ The build script (`build-all.mjs`) validates that each adapter exists in `prebid
 Adding a new client-side bidder requires both a config change (`client_side_bidders`) **and** a rebuild with the adapter included in `TSJS_PREBID_ADAPTERS`. Without the adapter in the bundle, the bidder is silently dropped from both server-side and client-side auctions.
 :::
 
+## User ID Modules
+
+Prebid's User ID Module resolves cross-publisher identifiers (SharedID, ID5, LiveRamp RampID, UID2, etc.) and exposes them via `pbjs.getUserIdsAsEids()`. The TSJS Prebid integration bundles the core `userId.js` module and a configurable set of ID submodules. When the publisher's origin-side `pbjs.setConfig({ userSync: { userIds: [...] } })` call runs during `processQueue()`, each listed submodule activates and begins resolving its ID asynchronously. After each auction the shim writes the resolved EIDs to a `ts-eids` cookie, which the Rust backend ingests into the Edge Cookie identity graph.
+
+### How it works
+
+1. `userId.js` is statically imported in `index.ts` — always bundled, not operator-configurable.
+2. The set of ID submodules is controlled by `TSJS_PREBID_USER_IDS` at build time and emitted into `_user_ids.generated.ts`.
+3. Publishers retain full control of which submodules actually run — activation is driven by their own `pbjs.setConfig({ userSync: { userIds: [...] } })` on origin. Bundling a submodule without a matching publisher config entry is inert (but costs bundle size).
+4. The `bidsBackHandler` shim calls `pbjs.getUserIdsAsEids()` after each auction and writes the resolved entries to the `ts-eids` cookie (base64-encoded JSON, 3072-byte cap with tail-trim).
+
+### Build-time submodule selection
+
+```bash
+# Default: the full ship-set of 13 submodules
+# (sharedIdSystem, criteoIdSystem, 33acrossIdSystem, pubProvidedIdSystem,
+#  quantcastIdSystem, id5IdSystem, identityLinkIdSystem, uid2IdSystem,
+#  euidIdSystem, intentIqIdSystem, lotamePanoramaIdSystem, connectIdSystem,
+#  merkleIdSystem)
+
+# Slim build — only SharedID and ID5
+TSJS_PREBID_USER_IDS=sharedIdSystem,id5IdSystem
+
+# Single submodule
+TSJS_PREBID_USER_IDS=sharedIdSystem
+```
+
+Values are Prebid module filenames without the `.js` extension. The build script (`build-all.mjs`) validates that each exists in `prebid.js/modules/{name}.js` and generates `_user_ids.generated.ts` with the appropriate imports. Unknown names log a warning and are skipped.
+
+::: warning
+`liveIntentIdSystem` is on a build-time denylist — its upstream module uses a dynamic `require()` that esbuild cannot statically resolve, throwing `ReferenceError: require is not defined` at browser runtime. Listing it in `TSJS_PREBID_USER_IDS` logs a warning and skips the module.
+:::
+
+::: tip
+Each bundled submodule bloats `tsjs-prebid.js`. If a publisher deployment only needs SharedID and ID5, set `TSJS_PREBID_USER_IDS` accordingly — the other ~100kb of dormant module code won't ship.
+:::
+
 ## Identity Forwarding
 
 Trusted Server uses a **hybrid EID forwarding model** for Prebid-routed auctions:
diff --git a/docs/superpowers/plans/2026-04-15-sourcepoint-gpp-consent.md b/docs/superpowers/plans/2026-04-15-sourcepoint-gpp-consent.md
new file mode 100644
index 00000000..8c9de843
--- /dev/null
+++ b/docs/superpowers/plans/2026-04-15-sourcepoint-gpp-consent.md
@@ -0,0 +1,695 @@
+# Sourcepoint GPP Consent for Edge Cookie Generation — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Enable EC generation for sites using Sourcepoint by mirroring localStorage consent into cookies (client) and recognizing GPP US `sale_opt_out` as a consent signal (server).
+
+**Architecture:** New JS-only `sourcepoint` integration auto-discovers `_sp_user_consent_*` in localStorage and writes `__gpp` / `__gpp_sid` cookies. Server-side, `GppConsent` gains a `us_sale_opt_out: Option<bool>` field extracted from any GPP US section (IDs 7–23). `allows_ec_creation()` checks this field between the existing TCF and `us_privacy` branches.
+
+**Tech Stack:** TypeScript (Vitest, jsdom), Rust (iab_gpp crate for GPP section decoding)
+
+**Spec:** `docs/superpowers/specs/2026-04-15-sourcepoint-gpp-consent-design.md`
+
+---
+
+## File Map
+
+| File | Action | Responsibility |
+|---|---|---|
+| `crates/trusted-server-core/src/consent/types.rs` | Modify | Add `us_sale_opt_out: Option<bool>` to `GppConsent` |
+| `crates/trusted-server-core/src/consent/gpp.rs` | Modify | Decode US sections, extract `sale_opt_out` |
+| `crates/trusted-server-core/src/consent/mod.rs` | Modify | Add GPP US branch in `allows_ec_creation()`, tests |
+| `crates/js/lib/src/integrations/sourcepoint/index.ts` | Create | localStorage auto-discovery, cookie mirroring |
+| `crates/js/lib/test/integrations/sourcepoint/index.test.ts` | Create | Vitest tests for cookie mirroring |
+
+---
+
+## Task 1: Add `us_sale_opt_out` field to `GppConsent`
+
+**Files:**
+- Modify: `crates/trusted-server-core/src/consent/types.rs:297-305`
+
+- [ ] **Step 1: Add the field**
+
+In `crates/trusted-server-core/src/consent/types.rs`, add `us_sale_opt_out` to `GppConsent`:
+
+```rust
+/// Decoded GPP (Global Privacy Platform) consent data.
+///
+/// Wraps the `iab_gpp` crate's decoded output with our domain types.
+#[derive(Debug, Clone)]
+pub struct GppConsent {
+    /// GPP header version.
+    pub version: u8,
+    /// Active section IDs present in the GPP string.
+    pub section_ids: Vec<u16>,
+    /// Decoded EU TCF v2.2 section (if present in GPP, section ID 2).
+    pub eu_tcf: Option<TcfConsent>,
+    /// Whether the user opted out of sale of personal information via a US GPP
+    /// section (IDs 7–23).
+    ///
+    /// - `Some(true)` — a US section is present and `sale_opt_out == OptedOut`
+    /// - `Some(false)` — a US section is present and user did not opt out
+    /// - `None` — no US section exists in the GPP string
+    pub us_sale_opt_out: Option<bool>,
+}
+```
+
+- [ ] **Step 2: Fix compilation — update all `GppConsent` construction sites**
+
+There are existing places that construct `GppConsent`. Each needs the new field. Search for them:
+
+In `crates/trusted-server-core/src/consent/gpp.rs` (~line 74), update `decode_gpp_string`:
+
+```rust
+    Ok(GppConsent {
+        version: 1,
+        section_ids,
+        eu_tcf,
+        us_sale_opt_out: None, // placeholder — Task 2 fills this in
+    })
+```
+
+In `crates/trusted-server-core/src/consent/mod.rs`, find every test that constructs `GppConsent` (search for `GppConsent {`). Add `us_sale_opt_out: None` to each. There are instances around lines 720, 883, and 965:
+
+```rust
+    gpp: Some(GppConsent {
+        version: 1,
+        section_ids: vec![2],
+        eu_tcf: Some(...),
+        us_sale_opt_out: None,
+    }),
+```
+
+- [ ] **Step 3: Verify compilation**
+
+Run: `cargo check --workspace`
+Expected: compiles with no errors.
+
+- [ ] **Step 4: Run tests to confirm nothing broke**
+
+Run: `cargo test --workspace`
+Expected: all existing tests pass.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/consent/types.rs \
+       crates/trusted-server-core/src/consent/gpp.rs \
+       crates/trusted-server-core/src/consent/mod.rs
+git commit -m "Add us_sale_opt_out field to GppConsent"
+```
+
+---
+
+## Task 2: Decode US sale opt-out from GPP sections
+
+**Files:**
+- Modify: `crates/trusted-server-core/src/consent/gpp.rs`
+
+- [ ] **Step 1: Write the failing test for US sale opt-out extraction**
+
+Add to the `#[cfg(test)] mod tests` block in `crates/trusted-server-core/src/consent/gpp.rs`:
+
+```rust
+    // A GPP string with UsNat section (section ID 7).
+    // Header "DBABLA" encodes: version=1, section IDs=[7] (UsNat).
+    // The section string encodes a UsNat v1 core with sale_opt_out=DidNotOptOut (2).
+    #[test]
+    fn decodes_us_sale_opt_out_not_opted_out() {
+        // Build a real GPP string with UsNat section using iab_gpp parsing.
+        // "DBABLA~BVQqAAAAAgA.QA" is the example from the issue (Sourcepoint payload).
+        let result = decode_gpp_string("DBABLA~BVQqAAAAAgA.QA");
+        match &result {
+            Ok(gpp) => {
+                assert_eq!(
+                    gpp.us_sale_opt_out,
+                    Some(false),
+                    "should extract sale_opt_out=false from UsNat section"
+                );
+            }
+            Err(e) => {
+                // If the specific GPP string doesn't parse, test with section ID presence.
+                // The important thing is that the decode_us_sale_opt_out function is wired up.
+                panic!("GPP decode failed: {e}");
+            }
+        }
+    }
+
+    #[test]
+    fn no_us_section_returns_none() {
+        // GPP_TCF_AND_USP has section IDs [2, 6] — no US sections (7–23).
+        let result = decode_gpp_string(GPP_TCF_AND_USP).expect("should decode GPP");
+        assert_eq!(
+            result.us_sale_opt_out, None,
+            "should return None when no US section (7-23) is present"
+        );
+    }
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `cargo test --workspace -p trusted-server-core -- consent::gpp::tests::decodes_us_sale_opt_out`
+Expected: FAIL — `us_sale_opt_out` is hardcoded to `None`.
+
+- [ ] **Step 3: Implement `decode_us_sale_opt_out`**
+
+In `crates/trusted-server-core/src/consent/gpp.rs`, add after `decode_tcf_from_gpp`:
+
+```rust
+/// GPP section IDs that represent US state/national privacy sections.
+///
+/// Range 7–23 per the GPP v1 specification:
+/// 7=UsNat, 8=UsCa, 9=UsVa, 10=UsCo, 11=UsUt, 12=UsCt, 13=UsFl,
+/// 14=UsMt, 15=UsOr, 16=UsTx, 17=UsDe, 18=UsIa, 19=UsNe, 20=UsNh,
+/// 21=UsNj, 22=UsTn, 23=UsMn.
+const US_SECTION_ID_RANGE: std::ops::RangeInclusive<u16> = 7..=23;
+
+/// Extracts the `sale_opt_out` signal from the first US section in a parsed
+/// GPP string.
+///
+/// Iterates through section IDs looking for any in the US range (7–23).
+/// For the first match, decodes the section and extracts `sale_opt_out`.
+///
+/// Returns `Some(true)` if the user opted out of sale, `Some(false)` if they
+/// did not, or `None` if no US section is present.
+fn decode_us_sale_opt_out(parsed: &iab_gpp::v1::GPPString) -> Option<bool> {
+    use iab_gpp::sections::us_common::OptOut;
+    use iab_gpp::sections::Section;
+
+    let us_section_id = parsed
+        .section_ids()
+        .find(|id| US_SECTION_ID_RANGE.contains(&(**id as u16)))?;
+
+    match parsed.decode_section(*us_section_id) {
+        Ok(section) => {
+            let sale_opt_out = match &section {
+                Section::UsNat(s) => match &s.core {
+                    iab_gpp::sections::usnat::Core::V1(c) => &c.sale_opt_out,
+                    iab_gpp::sections::usnat::Core::V2(c) => &c.sale_opt_out,
+                },
+                Section::UsCa(s) => &s.core.sale_opt_out,
+                Section::UsVa(s) => &s.core.sale_opt_out,
+                Section::UsCo(s) => &s.core.sale_opt_out,
+                Section::UsUt(s) => &s.core.sale_opt_out,
+                Section::UsCt(s) => &s.core.sale_opt_out,
+                Section::UsFl(s) => &s.core.sale_opt_out,
+                Section::UsMt(s) => &s.core.sale_opt_out,
+                Section::UsOr(s) => &s.core.sale_opt_out,
+                Section::UsTx(s) => &s.core.sale_opt_out,
+                Section::UsDe(s) => &s.core.sale_opt_out,
+                Section::UsIa(s) => &s.core.sale_opt_out,
+                Section::UsNe(s) => &s.core.sale_opt_out,
+                Section::UsNh(s) => &s.core.sale_opt_out,
+                Section::UsNj(s) => &s.core.sale_opt_out,
+                Section::UsTn(s) => &s.core.sale_opt_out,
+                Section::UsMn(s) => &s.core.sale_opt_out,
+                // Non-US sections — should not reach here given the ID filter.
+                _ => return None,
+            };
+            Some(*sale_opt_out == OptOut::OptedOut)
+        }
+        Err(e) => {
+            log::warn!("Failed to decode US GPP section {us_section_id}: {e}");
+            None
+        }
+    }
+}
+```
+
+- [ ] **Step 4: Wire it into `decode_gpp_string`**
+
+In the same file, replace the placeholder in `decode_gpp_string`:
+
+```rust
+    let us_sale_opt_out = decode_us_sale_opt_out(&parsed);
+
+    Ok(GppConsent {
+        version: 1,
+        section_ids,
+        eu_tcf,
+        us_sale_opt_out,
+    })
+```
+
+- [ ] **Step 5: Run tests**
+
+Run: `cargo test --workspace -p trusted-server-core -- consent::gpp::tests`
+Expected: all GPP tests pass, including the two new ones.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add crates/trusted-server-core/src/consent/gpp.rs
+git commit -m "Decode US sale opt-out from GPP sections"
+```
+
+---
+
+## Task 3: Add GPP US branch to `allows_ec_creation()`
+
+**Files:**
+- Modify: `crates/trusted-server-core/src/consent/mod.rs`
+
+- [ ] **Step 1: Write failing tests**
+
+Add to the `#[cfg(test)] mod tests` block in `crates/trusted-server-core/src/consent/mod.rs`:
+
+```rust
+    #[test]
+    fn ec_allowed_us_state_gpp_no_sale_opt_out() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("TN".to_owned()),
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![7],
+                eu_tcf: None,
+                us_sale_opt_out: Some(false),
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            allows_ec_creation(&ctx),
+            "US state + GPP US sale_opt_out=false should allow EC"
+        );
+    }
+
+    #[test]
+    fn ec_blocked_us_state_gpp_sale_opted_out() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("TN".to_owned()),
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![7],
+                eu_tcf: None,
+                us_sale_opt_out: Some(true),
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            !allows_ec_creation(&ctx),
+            "US state + GPP US sale_opt_out=true should block EC"
+        );
+    }
+
+    #[test]
+    fn ec_blocked_us_state_gpc_overrides_gpp_us() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("TN".to_owned()),
+            gpc: true,
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![7],
+                eu_tcf: None,
+                us_sale_opt_out: Some(false),
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            !allows_ec_creation(&ctx),
+            "GPC should block EC even when GPP US says no opt-out"
+        );
+    }
+
+    #[test]
+    fn ec_us_state_tcf_takes_priority_over_gpp_us() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("TN".to_owned()),
+            tcf: Some(make_tcf_with_storage(true)),
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![7],
+                eu_tcf: None,
+                us_sale_opt_out: Some(true),
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            allows_ec_creation(&ctx),
+            "TCF consent should take priority over GPP US opt-out"
+        );
+    }
+
+    #[test]
+    fn ec_us_state_gpp_us_takes_priority_over_us_privacy() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("TN".to_owned()),
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![7],
+                eu_tcf: None,
+                us_sale_opt_out: Some(false),
+            }),
+            us_privacy: Some(UsPrivacy {
+                version: 1,
+                notice_given: PrivacyFlag::Yes,
+                opt_out_sale: PrivacyFlag::Yes,
+                lspa_covered: PrivacyFlag::NotApplicable,
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            allows_ec_creation(&ctx),
+            "GPP US should take priority over us_privacy opt-out"
+        );
+    }
+
+    #[test]
+    fn ec_us_state_gpp_no_us_section_falls_through_to_us_privacy() {
+        let ctx = ConsentContext {
+            jurisdiction: Jurisdiction::UsState("CA".to_owned()),
+            gpp: Some(GppConsent {
+                version: 1,
+                section_ids: vec![2],
+                eu_tcf: None,
+                us_sale_opt_out: None,
+            }),
+            us_privacy: Some(UsPrivacy {
+                version: 1,
+                notice_given: PrivacyFlag::Yes,
+                opt_out_sale: PrivacyFlag::No,
+                lspa_covered: PrivacyFlag::NotApplicable,
+            }),
+            ..ConsentContext::default()
+        };
+        assert!(
+            allows_ec_creation(&ctx),
+            "GPP without US section should fall through to us_privacy"
+        );
+    }
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `cargo test --workspace -p trusted-server-core -- consent::tests::ec_allowed_us_state_gpp`
+Expected: FAIL — the GPP US branch doesn't exist yet, so `ec_allowed_us_state_gpp_no_sale_opt_out` fails (falls through to fail-closed).
+
+- [ ] **Step 3: Add the GPP US branch to `allows_ec_creation()`**
+
+In `crates/trusted-server-core/src/consent/mod.rs`, update `allows_ec_creation()`. The `UsState` arm currently reads:
+
+```rust
+        jurisdiction::Jurisdiction::UsState(_) => {
+            if ctx.gpc {
+                return false;
+            }
+            if let Some(tcf) = effective_tcf(ctx) {
+                return tcf.has_storage_consent();
+            }
+            if let Some(usp) = &ctx.us_privacy {
+                return usp.opt_out_sale != PrivacyFlag::Yes;
+            }
+            false
+        }
+```
+
+Insert the GPP US check between TCF and us_privacy:
+
+```rust
+        jurisdiction::Jurisdiction::UsState(_) => {
+            if ctx.gpc {
+                return false;
+            }
+            if let Some(tcf) = effective_tcf(ctx) {
+                return tcf.has_storage_consent();
+            }
+            // Check GPP US section for sale opt-out.
+            if let Some(gpp) = &ctx.gpp {
+                if let Some(opted_out) = gpp.us_sale_opt_out {
+                    return !opted_out;
+                }
+            }
+            if let Some(usp) = &ctx.us_privacy {
+                return usp.opt_out_sale != PrivacyFlag::Yes;
+            }
+            false
+        }
+```
+
+- [ ] **Step 4: Run all tests**
+
+Run: `cargo test --workspace`
+Expected: all tests pass, including the six new EC gating tests.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add crates/trusted-server-core/src/consent/mod.rs
+git commit -m "Recognize GPP US sale opt-out in EC consent gating"
+```
+
+---
+
+## Task 4: Create Sourcepoint JS integration
+
+**Files:**
+- Create: `crates/js/lib/src/integrations/sourcepoint/index.ts`
+
+- [ ] **Step 1: Write the test file first**
+
+Create `crates/js/lib/test/integrations/sourcepoint/index.test.ts`:
+
+```typescript
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { mirrorSourcepointConsent } from '../../../src/integrations/sourcepoint';
+
+describe('integrations/sourcepoint', () => {
+  beforeEach(() => {
+    // Clear cookies and localStorage before each test.
+    document.cookie.split(';').forEach((c) => {
+      const name = c.split('=')[0].trim();
+      if (name) document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/`;
+    });
+    localStorage.clear();
+  });
+
+  afterEach(() => {
+    localStorage.clear();
+  });
+
+  it('mirrors __gpp and __gpp_sid from _sp_user_consent_* localStorage', () => {
+    const payload = {
+      gppData: {
+        gppString: 'DBABLA~BVQqAAAAAgA.QA',
+        applicableSections: [7],
+      },
+    };
+    localStorage.setItem('_sp_user_consent_36026', JSON.stringify(payload));
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(true);
+    expect(document.cookie).toContain('__gpp=DBABLA~BVQqAAAAAgA.QA');
+    expect(document.cookie).toContain('__gpp_sid=7');
+  });
+
+  it('handles multiple applicable sections', () => {
+    const payload = {
+      gppData: {
+        gppString: 'DBABLA~BVQqAAAAAgA.QA',
+        applicableSections: [7, 8],
+      },
+    };
+    localStorage.setItem('_sp_user_consent_99999', JSON.stringify(payload));
+
+    mirrorSourcepointConsent();
+
+    expect(document.cookie).toContain('__gpp_sid=7,8');
+  });
+
+  it('returns false when no _sp_user_consent_* key exists', () => {
+    localStorage.setItem('unrelated_key', 'value');
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(false);
+    expect(document.cookie).not.toContain('__gpp=');
+    expect(document.cookie).not.toContain('__gpp_sid=');
+  });
+
+  it('returns false for malformed JSON in localStorage', () => {
+    localStorage.setItem('_sp_user_consent_12345', 'not-json!!!');
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(false);
+    expect(document.cookie).not.toContain('__gpp=');
+  });
+
+  it('returns false when gppData is missing from payload', () => {
+    localStorage.setItem('_sp_user_consent_12345', JSON.stringify({ otherField: true }));
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(false);
+    expect(document.cookie).not.toContain('__gpp=');
+  });
+
+  it('returns false when gppString is empty', () => {
+    const payload = {
+      gppData: {
+        gppString: '',
+        applicableSections: [7],
+      },
+    };
+    localStorage.setItem('_sp_user_consent_12345', JSON.stringify(payload));
+
+    const result = mirrorSourcepointConsent();
+
+    expect(result).toBe(false);
+    expect(document.cookie).not.toContain('__gpp=');
+  });
+});
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `cd crates/js/lib && npx vitest run test/integrations/sourcepoint/index.test.ts`
+Expected: FAIL — module `../../../src/integrations/sourcepoint` does not exist.
+
+- [ ] **Step 3: Implement the integration**
+
+Create `crates/js/lib/src/integrations/sourcepoint/index.ts`:
+
+```typescript
+import { log } from '../../core/log';
+
+const SP_CONSENT_PREFIX = '_sp_user_consent_';
+
+interface SourcepointGppData {
+  gppString: string;
+  applicableSections: number[];
+}
+
+interface SourcepointConsentPayload {
+  gppData?: SourcepointGppData;
+}
+
+function findSourcepointConsent(): SourcepointConsentPayload | null {
+  for (let i = 0; i < localStorage.length; i++) {
+    const key = localStorage.key(i);
+    if (!key?.startsWith(SP_CONSENT_PREFIX)) continue;
+
+    const raw = localStorage.getItem(key);
+    if (!raw) continue;
+
+    try {
+      return JSON.parse(raw) as SourcepointConsentPayload;
+    } catch {
+      log.debug('sourcepoint: failed to parse localStorage value', { key });
+      return null;
+    }
+  }
+  return null;
+}
+
+function writeCookie(name: string, value: string): void {
+  document.cookie = `${name}=${encodeURIComponent(value)}; path=/; SameSite=Lax`;
+}
+
+/// Reads Sourcepoint consent from localStorage and mirrors it into
+/// `__gpp` and `__gpp_sid` cookies for Trusted Server to read.
+///
+/// Returns `true` if cookies were written, `false` otherwise.
+export function mirrorSourcepointConsent(): boolean {
+  if (typeof localStorage === 'undefined' || typeof document === 'undefined') {
+    return false;
+  }
+
+  const payload = findSourcepointConsent();
+  if (!payload?.gppData) {
+    log.debug('sourcepoint: no GPP data found in localStorage');
+    return false;
+  }
+
+  const { gppString, applicableSections } = payload.gppData;
+  if (!gppString) {
+    log.debug('sourcepoint: gppString is empty');
+    return false;
+  }
+
+  writeCookie('__gpp', gppString);
+
+  if (Array.isArray(applicableSections) && applicableSections.length > 0) {
+    writeCookie('__gpp_sid', applicableSections.join(','));
+  }
+
+  log.info('sourcepoint: mirrored GPP consent to cookies', {
+    gppLength: gppString.length,
+    sections: applicableSections,
+  });
+
+  return true;
+}
+
+if (typeof window !== 'undefined') {
+  mirrorSourcepointConsent();
+}
+
+export default mirrorSourcepointConsent;
+```
+
+- [ ] **Step 4: Run tests**
+
+Run: `cd crates/js/lib && npx vitest run test/integrations/sourcepoint/index.test.ts`
+Expected: all 6 tests pass.
+
+- [ ] **Step 5: Run the full JS test suite**
+
+Run: `cd crates/js/lib && npx vitest run`
+Expected: all tests pass (existing + new).
+
+- [ ] **Step 6: Format**
+
+Run: `cd crates/js/lib && npm run format`
+Expected: no formatting issues.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add crates/js/lib/src/integrations/sourcepoint/index.ts \
+       crates/js/lib/test/integrations/sourcepoint/index.test.ts
+git commit -m "Add Sourcepoint JS integration for GPP consent cookie mirroring"
+```
+
+---
+
+## Task 5: Final verification
+
+**Files:** None (verification only)
+
+- [ ] **Step 1: Build the JS bundles**
+
+Run: `cd crates/js/lib && node build-all.mjs`
+Expected: builds successfully, `dist/tsjs-sourcepoint.js` appears in the output.
+
+- [ ] **Step 2: Full Rust build**
+
+Run: `cargo build --workspace`
+Expected: compiles with no errors.
+
+- [ ] **Step 3: Full Rust test suite**
+
+Run: `cargo test --workspace`
+Expected: all tests pass.
+
+- [ ] **Step 4: Clippy**
+
+Run: `cargo clippy --workspace --all-targets --all-features -- -D warnings`
+Expected: no warnings.
+
+- [ ] **Step 5: Rust format check**
+
+Run: `cargo fmt --all -- --check`
+Expected: no formatting issues.
+
+- [ ] **Step 6: Full JS test suite**
+
+Run: `cd crates/js/lib && npx vitest run`
+Expected: all tests pass.
+
+- [ ] **Step 7: JS format check**
+
+Run: `cd crates/js/lib && npm run format`
+Expected: no formatting issues.
diff --git a/docs/superpowers/specs/2026-04-15-sourcepoint-gpp-consent-design.md b/docs/superpowers/specs/2026-04-15-sourcepoint-gpp-consent-design.md
new file mode 100644
index 00000000..2455e12a
--- /dev/null
+++ b/docs/superpowers/specs/2026-04-15-sourcepoint-gpp-consent-design.md
@@ -0,0 +1,153 @@
+# Sourcepoint GPP Consent for Edge Cookie Generation
+
+**Issue:** #640
+**Date:** 2026-04-15
+**Status:** Approved
+
+## Problem
+
+Edge Cookie (EC) generation fails for sites using Sourcepoint when consent is
+stored only in `localStorage` and not surfaced via the standard cookies Trusted
+Server reads. Sourcepoint stores US consent under `_sp_user_consent_*` keys in
+`localStorage`, including a full GPP string and applicable section IDs.
+
+Today, Trusted Server only reads consent from `euconsent-v2`, `__gpp`,
+`__gpp_sid`, `us_privacy` cookies and the `Sec-GPC` header. Even if `__gpp` /
+`__gpp_sid` were present, the server only decodes the EU TCF v2 section from
+GPP — it does not use GPP US sections as a consent signal for EC gating.
+
+This creates two gaps:
+
+1. **Transport gap:** The server cannot read browser `localStorage`, so no
+   consent reaches the backend unless client code mirrors it into cookies.
+2. **Semantics gap:** Even with `__gpp` / `__gpp_sid` cookies present, current
+   US-state EC gating does not recognize GPP US sections as valid consent.
+
+## Approach
+
+Thin GPP pass-through: mirror Sourcepoint localStorage consent into standard
+cookies on the client, and extend server-side EC gating to recognize GPP US
+`sale_opt_out` as a consent signal. No compatibility bridge (`us_privacy`
+derivation) — both client and server changes ship together.
+
+## Design
+
+### 1. Client-side: Sourcepoint JS integration
+
+New JS-only integration at `crates/js/lib/src/integrations/sourcepoint/index.ts`.
+No Rust-side `IntegrationRegistration` (same pattern as `creative`).
+
+**On page load:**
+
+1. Scan `localStorage` keys matching `_sp_user_consent_*`.
+2. Take the first valid match, parse the JSON value.
+3. Extract `gppData.gppString` and `gppData.applicableSections` from the payload.
+4. Write first-party cookies:
+   - `__gpp=<gpp string>` (path `/`, `SameSite=Lax`)
+   - `__gpp_sid=<comma-separated section IDs>` (path `/`, `SameSite=Lax`)
+5. Log what was written for debugging.
+
+Cookies are session-scoped (no `max-age` / `expires`) since the source of truth
+stays in `localStorage` and we re-mirror on each page load. This design assumes
+a single active Sourcepoint property per page; if multiple `_sp_user_consent_*`
+entries coexist, the first valid one wins. The integration runs once — no
+polling or event listeners.
+
+### 2. Server-side: GPP US section decoding
+
+**`crates/trusted-server-core/src/consent/types.rs`** — extend `GppConsent`:
+
+```rust
+pub struct GppConsent {
+    pub version: u8,
+    pub section_ids: Vec<u16>,
+    pub eu_tcf: Option<TcfConsent>,
+    pub us_sale_opt_out: Option<bool>,  // new
+}
+```
+
+- `Some(true)` — a US section is present and `sale_opt_out == OptedOut`
+- `Some(false)` — a US section is present and `sale_opt_out != OptedOut`
+- `None` — no US section exists in the GPP string
+
+**`crates/trusted-server-core/src/consent/gpp.rs`** — add `decode_us_sale_opt_out`:
+
+Checks for any US section ID (7–23) in the parsed `GPPString`. For the first
+match, decodes the section via `iab_gpp` and extracts `sale_opt_out`. Maps
+`OptOut::OptedOut` to `true`, everything else to `false`.
+
+The `iab_gpp` crate uses different structs per state (`UsNat`, `UsCa`, `UsTn`,
+etc.) but they all have `sale_opt_out: OptOut` via `us_common`. We match on the
+decoded `Section` enum to extract it.
+
+### 3. Server-side: EC gating update
+
+**`crates/trusted-server-core/src/consent/mod.rs`** — update `allows_ec_creation()`
+for `Jurisdiction::UsState(_)`.
+
+New precedence chain:
+
+```
+GPC → TCF → GPP US sale_opt_out → us_privacy → fail-closed
+```
+
+Insert between the existing TCF and `us_privacy` branches:
+
+```rust
+// Check GPP US section for sale opt-out.
+if let Some(gpp) = &ctx.gpp {
+    if let Some(opted_out) = gpp.us_sale_opt_out {
+        return !opted_out;
+    }
+}
+```
+
+Semantics:
+
+- GPP US `sale_opt_out != OptedOut` → EC allowed
+- GPP US `sale_opt_out == OptedOut` → EC blocked
+- No GPP US section → falls through to `us_privacy`
+- GPC still short-circuits at the top (unchanged)
+- TCF still takes priority for CMPs like Didomi (unchanged)
+
+### 4. Files touched
+
+| File | Change |
+|---|---|
+| `crates/js/lib/src/integrations/sourcepoint/index.ts` | New — localStorage auto-discovery, cookie mirroring |
+| `crates/js/lib/src/integrations/sourcepoint/index.test.ts` | New — Vitest tests |
+| `crates/trusted-server-core/src/consent/types.rs` | Add `us_sale_opt_out: Option<bool>` to `GppConsent` |
+| `crates/trusted-server-core/src/consent/gpp.rs` | Add US section decoding, extract `sale_opt_out` |
+| `crates/trusted-server-core/src/consent/mod.rs` | Add GPP US branch in `allows_ec_creation()`, tests |
+
+No config changes, no new crate dependencies, no `IntegrationRegistry` changes.
+
+### 5. Testing
+
+**JS (Vitest):**
+
+- Mirrors `__gpp` and `__gpp_sid` from `_sp_user_consent_*` localStorage
+- No cookies written when no `_sp_user_consent_*` key exists
+- Graceful handling of malformed JSON in localStorage
+
+**Rust — EC gating (`consent/mod.rs`):**
+
+- EC allowed: US state + GPP `us_sale_opt_out = Some(false)`
+- EC blocked: US state + GPP `us_sale_opt_out = Some(true)`
+- EC blocked: GPC overrides permissive GPP US
+- TCF takes priority over GPP US when both present
+- GPP US takes priority over `us_privacy` when both present
+- No GPP US section falls through to `us_privacy`
+- No signals → fail-closed
+
+**Rust — GPP decoding (`consent/gpp.rs`):**
+
+- Extracts `us_sale_opt_out` from GPP string with UsNat section (ID 7)
+- `us_sale_opt_out` is `None` when GPP has no US sections
+
+### 6. Non-goals
+
+- No `us_privacy` compatibility bridge (skipped per decision)
+- No richer US GPP field extraction (sharing, targeted advertising opt-outs)
+- No publisher configuration for Sourcepoint property ID (auto-discovery)
+- No Sourcepoint CMP API integration (localStorage-only approach)